# Module cargo::sources::git::known_hosts

source ·
Expand description

SSH host key validation support.

The only public item in this module is `certificate_check`, which provides a callback to `git2::RemoteCallbacks::certificate_check`.

A primary goal with this implementation is to provide user-friendly error messages, guiding them to understand the issue and how to resolve it.

Note that there are a lot of limitations here. This reads OpenSSH known_hosts files from well-known locations, but it does not read OpenSSH config files. The config file can change the behavior of how OpenSSH handles known_hosts files. For example, some things we don’t handle:

- `GlobalKnownHostsFile` — Changes the location of the global host file.
- `UserKnownHostsFile` — Changes the location of the user’s host file.
- `KnownHostsCommand` — A command to fetch known hosts.
- `CheckHostIP` — DNS spoofing checks.
- `VisualHostKey` — Shows a visual ascii-art key.
- `VerifyHostKeyDNS` — Uses SSHFP DNS records to fetch a host key.

There’s also a number of things that aren’t supported but could be easily added (it just adds a little complexity). For example, hostname patterns, and revoked markers. See “FIXME” comments littered in this file.

## Structs

- KnownHost 🔒
  A single known host entry.

## Enums

- KnownHostError 🔒
- KnownHostLineType 🔒
- KnownHostLocation 🔒
  The location where a host key was located.

## Constants

- HASH_HOSTNAME_PREFIX 🔒

## Statics

- BUNDLED_KEYS 🔒
  These are host keys that are hard-coded in cargo to provide convenience.
- BUNDLED_REVOCATIONS 🔒
  List of keys that public hosts have rotated away from.

## Functions

- certificate_check
  The git2 callback used to validate a certificate (only ssh known hosts are validated).
- check_ssh_known_hosts 🔒
  Checks if the given host/host key pair is known.
- check_ssh_known_hosts_loaded 🔒
  Checks a host key against a loaded set of known hosts.
- hashed_hostname_matches 🔒
- known_host_files 🔒
  Returns a list of files to try loading OpenSSH-formatted known hosts.
- load_hostfile 🔒
  Loads an OpenSSH known_hosts file.
- load_hostfile_contents 🔒
- parse_known_hosts_line 🔒
- user_known_host_location 🔒
  The location of the user’s known_hosts file.
- user_known_host_location_to_add 🔒
  The location to display in an error message instructing the user where to add the new key.